fix(config): never reveal short API keys in model list

[imMamdouhaboammar]

Summary

Prevent helixent config model list from revealing an entire API key when the configured secret is four characters or shorter.

Root cause

The command displayed credentials as ****${APIKey.slice(-4)}. For normal long API keys this reveals only a suffix, but the config schema accepts any non-empty key. A 1 to 4 character secret is therefore reproduced in full after the mask prefix.

Changes

• fully mask API keys of length 4 or less
• retain the existing last-four suffix behavior for longer keys
• centralize masking in a small helper used by the list command
• add regression tests proving short secrets never appear and longer secrets expose only their final four characters

This complements filesystem permission hardening by keeping the CLI display path from disclosing short configured credentials.